rule n1fid04w_exe meta: description = "Detects known n1fid04w.exe samples" author = "Security Analyst" date = "2024-03-12" strings: $s1 = "n1fid04w" nocase $s2 = 68 ?? ?? ?? ?? 6A 00 6A 01 6A 02 // typical prologue pattern condition: $s1 or $s2
